Ordinateur lent...

bonjour, postes nous un zhpdiag pour voir plus , merci

Ouvre ce lien et télécharge ZHPDiag :

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

cliques sur télécharger "celui de droite"

ou directement ici: https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

et si problème : http://www.premiumorange.com/zeb-help-process/zhpdiag.html

tu vas en bas de la page et tu télécharges le premier tu et tu dézippes

Enregistres le sur ton Bureau.

Une fois le téléchargement achevé

pour XP, double-clique sur ZHPDiag

pour Vista,et seven tu fais un clic droit sur l'icône et exécute en tant qu'administrateur.

N'oublies pas de cocher la case qui permet de mettre un raccourci sur le Bureau.

/|\ l'outil a créé 2 icônes ZHPDiag et ZHPFix.

Double cliques sur le raccourci ZHPDiag sur ton Bureau pour XP sinon clique droit et en tant que administrateur !!

Clique sur le Tournevis puis sur Tous pour cocher toutes les cases des options.

Cliques sur la loupe pour lancer l'analyse.

Laisses l'outil travailler, il peut être assez long.

A la fin de l'analyse,clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

Fermes ZHPDiag en fin d'analyse.

Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/index.php

Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\bureau\.ZHPDiag.txt

ou directement en choisissant bureau et ZHPDiag.txt clique dessus

Clique sur Ouvrir.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cib7SU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

Voilà le rapport :

http://www.cijoint.fr/cjlink.php?file=cj201009/cijXzIVOXv.txt

rapport Ad-remover :

http://www.cijoint.fr/cjlink.php?file=cj201009/cijU00w2S9.txt

Rapport de MalwareByte' :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4698

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

26/09/2010 16:38:14
mbam-log-2010-09-26 (16-38-14).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 233411
Temps écoulé: 3 heure(s), 19 minute(s), 46 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\31f0a8392b18ba14ab9c\Dc43.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.
C:\31f0a8392b18ba14ab9c\edb0000F.log (Extension.Mismatch) -> Quarantined and deleted successfully.
C:\31f0a8392b18ba14ab9c\002_1_~1.JPG (Extension.Mismatch) -> Quarantined and deleted successfully.
C:\31f0a8392b18ba14ab9c\009_1_~1.JPG (Extension.Mismatch) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\Astrid\Application Data\DesktopIcon\eBayShortcuts.exe.vir (Adware.ADON) -> Quarantined and deleted successfully.

rapport ZHPDiag :

http://www.cijoint.fr/cjlink.php?file=cj201009/cijzPjtfXC.txt

A) :

¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.8 ¤¤¤¤¤¤¤¤¤¤

User : Astrid (Administrateurs)
Update on 25/09/2010 by g3n-h@ckm@n ::::: 19.10
Start at: 17:32:42 | 26/09/2010

Intel(R) Celeron(R) CPU 2.40GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : avast! Antivirus 5.0.83886757 [ (!) Disabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 74,52 Go (25,73 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM

Boot: Normal

¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer

C:\windows\System32\smss.exe ---- 404 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ----
C:\windows\system32\csrss.exe ---- 4380 Ko ---- Normal ---- C:\windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ----
C:\windows\system32\winlogon.exe ---- 1336 Ko ---- High ---- winlogon.exe ----
C:\windows\system32\services.exe ---- 3628 Ko ---- Normal ---- C:\windows\system32\services.exe ----
C:\windows\system32\lsass.exe ---- 1984 Ko ---- Normal ---- C:\windows\system32\lsass.exe ----
C:\windows\system32\svchost.exe ---- 4872 Ko ---- Normal ---- C:\windows\system32\svchost -k DcomLaunch ----
C:\windows\system32\svchost.exe ---- 4292 Ko ---- Normal ---- C:\windows\system32\svchost -k rpcss ----
C:\windows\System32\svchost.exe ---- 29212 Ko ---- Normal ---- C:\windows\System32\svchost.exe -k netsvcs ----
C:\windows\system32\svchost.exe ---- 3328 Ko ---- Normal ---- C:\windows\system32\svchost.exe -k WudfServiceGroup ----
C:\windows\system32\svchost.exe ---- 3912 Ko ---- Normal ---- C:\windows\system32\svchost.exe -k NetworkService ----
C:\windows\system32\svchost.exe ---- 2964 Ko ---- Normal ---- C:\windows\system32\svchost.exe -k LocalService ----
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe ---- 30028 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe" ---- ALWIL Software
C:\windows\Explorer.EXE ---- 37412 Ko ---- Normal ---- C:\windows\Explorer.EXE ----
C:\windows\system32\spoolsv.exe ---- 5120 Ko ---- Normal ---- C:\windows\system32\spoolsv.exe ----
C:\windows\system32\svchost.exe ---- 3528 Ko ---- Normal ---- C:\windows\system32\svchost.exe -k LocalService ----
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe ---- 2396 Ko ---- Normal ---- "C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe" ---- ArcSoft, Inc.
C:\Program Files\Java\jre6\bin\jqs.exe ---- 1380 Ko ---- Idle ---- "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" ---- Sun Microsystems, Inc.
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE ---- 2920 Ko ---- Normal ---- "C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE" ---- Microsoft Corporation
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 8192 Ko ---- Normal ---- "C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe" ---- Microsoft Corporation
C:\windows\system32\svchost.exe ---- 4700 Ko ---- Normal ---- C:\windows\system32\svchost.exe -k imgsvc ----
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe ---- 1456 Ko ---- Normal ---- "C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe" ---- TomTom International BV
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe ---- 4852 Ko ---- Normal ---- "C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" ---- ArcSoft, Inc.
C:\Program Files\Java\jre6\bin\jusched.exe ---- 2468 Ko ---- Normal ---- "C:\Program Files\Java\jre6\bin\jusched.exe" ---- Sun Microsystems, Inc.
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ArcCon.ac ---- 8428 Ko ---- Normal ---- ArcCon.ac 65750 0 ---- ArcSoft, Inc.
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe ---- 3940 Ko ---- Normal ---- "C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe" /nogui ---- ALWIL Software
C:\windows\system32\ctfmon.exe ---- 3248 Ko ---- Normal ---- "C:\windows\system32\ctfmon.exe" ----
C:\Program Files\PrivacyEraser Computing\Free Internet Eraser\InternetEraser.exe ---- 5208 Ko ---- Normal ---- "C:\Program Files\PrivacyEraser Computing\Free Internet Eraser\InternetEraser.exe" /Startup ----
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe ---- 4128 Ko ---- Normal ---- "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" ---- TomTom International BV
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe ---- 3972 Ko ---- Normal ---- "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ----
C:\Program Files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe ---- 4552 Ko ---- Normal ---- "C:\Program Files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe" -silent ---- Koninklijke Philips Electronics N.V.
C:\windows\System32\alg.exe ---- 3552 Ko ---- Normal ---- C:\windows\System32\alg.exe ----
C:\WINDOWS\system32\wbem\wmiapsrv.exe ---- 4512 Ko ---- Normal ---- C:\WINDOWS\system32\wbem\wmiapsrv.exe ----
C:\windows\system32\wuauclt.exe ---- 4844 Ko ---- Normal ---- "C:\windows\system32\wuauclt.exe" ---- Microsoft Windows Component Publisher
C:\Program Files\Mozilla Firefox\firefox.exe ---- 94800 Ko ---- Normal ---- "C:\Program Files\Mozilla Firefox\firefox.exe" ---- Mozilla Corporation
C:\windows\system32\wscntfy.exe ---- 2660 Ko ---- Normal ---- C:\windows\system32\wscntfy.exe ----
C:\windows\system32\wuauclt.exe ---- 6900 Ko ---- Normal ---- "C:\windows\system32\wuauclt.exe" /RunStoreAsComServer Local\[3ec]SUSDS8d1a43049d4f904daac2220d3d84a0f7 ---- Microsoft Windows Component Publisher
C:\windows\system32\cmd.exe ---- 2812 Ko ---- Normal ---- C:\windows\system32\cmd.exe /K List'em.bat ----
C:\windows\system32\wbem\wmiprvse.exe ---- 6744 Ko ---- Normal ---- C:\windows\system32\wbem\wmiprvse.exe ----
C:\Program Files\List_Kill'em\pv.exe ---- 2756 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ----

¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE = C:\windows\system32\ctfmon.exe
Free Internet Eraser = C:\Program Files\PrivacyEraser Computing\Free Internet Eraser\InternetEraser.exe /Startup
Google Update = "C:\Documents and Settings\Astrid\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
TomTomHOME.exe = "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
ArcSoft Connection Service = C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
SunJavaUpdateSched = "C:\Program Files\Java\jre6\bin\jusched.exe"
avast5 = C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM = "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun = 145 (0x91)
NoBandCustomize = 0 (0x0)
NoMovingBands = 0 (0x0)
NoCloseDragDropBands = 0 (0x0)
NoSetTaskbar = 0 (0x0)
NoToolbarsOnTaskbar = 0 (0x0)
NoSaveSettings = 0 (0x0)
NoActiveDesktop = 0 (0x0)
ClassicShell = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting = 1 (0x1)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS =

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell = explorer.exe
Userinit = C:\WINDOWS\system32\userinit.exe,

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} =

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\LimeWire\LimeWire.exe = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Documents and Settings\Astrid\Local Settings\Temp\Rar$EX05.922\RayV\RayV.exe = C:\Documents and Settings\Astrid\Local Settings\Temp\Rar$EX05.922\RayV\RayV.exe:*:Enabled:RayV
C:\Program Files\Mozilla Firefox\firefox.exe = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox
C:\Program Files\Vuze\Azureus.exe = C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus
C:\WINDOWS\system32\muzapp.exe = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player
C:\WINDOWS\system32\dpvsetup.exe = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
C:\WINDOWS\system32\rundll32.exe = C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application
C:\Program Files\RayV\RayV\RayV.exe = C:\Program Files\RayV\RayV\RayV.exe:*:Enabled:RayV
C:\Program Files\RayV\RayV\RayV.dll = C:\Program Files\RayV\RayV\RayV.dll:*:Enabled:RayV
C:\Documents and Settings\Astrid\Application Data\RayV\Viewer\RayV.dll = C:\Documents and Settings\Astrid\Application Data\RayV\Viewer\RayV.dll:*:Enabled:RayV
C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe = C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix
C:\Program Files\Skype\Plugin Manager\skypePM.exe = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
C:\Program Files\Messenger\msmsgs.exe = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\River Past\Screen Recorder\ScreenRecorder.exe = C:\Program Files\River Past\Screen Recorder\ScreenRecorder.exe:*:Enabled:River Past Screen Recorder
C:\Program Files\aMSN\bin\wish.exe = C:\Program Files\aMSN\bin\wish.exe:*:Enabled:Wish Application
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
C:\Program Files\eMule\emule.exe = C:\Program Files\eMule\emule.exe:*:Enabled:eMule
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP2\WNt500x86\RpcSandraSrv.exe = C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP2\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service
C:\Program Files\VideoLAN\VLC\vlc.exe = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Skype\Phone\Skype.exe = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{20A60F0D-9AFA-4515-A0FD-83BD84642501}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4A85DBE0-BFB2-4119-8401-186A7C6EB653}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{50DC58D0-C870-4BE6-BC41-971ED2D5F022}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BD8667B7-38D8-4C77-B580-18C3E146372C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3F7924B9-D148-3141-87B1-68F36043A940}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{78DAFE83-7644-56CF-7131-A81361E4E24C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{11222041-111B-46E3-BD29-EFB2449479B1}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{C333CF63-767F-4831-94AC-E683D962C63C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]

¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E778C6B2-897F-4C95-9565-3B810BBB8128}: DhcpNameServer=85.255.112.132,85.255.112.188
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = %SystemRoot%\system32\blank.htm
Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = C:\windows\system32\blank.htm

¤¤¤¤¤ Proxy Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\apitrap.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ASSTE.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AVSTE.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Cleanup.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\cqw32.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\divx.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\divxdec.ax]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DJSMAR00.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DRMINST.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\enc98.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\EncodeDivXExt.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\EncryptPatchVer.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\front.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\fullsoft.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\GBROWSER.DLL]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\htmlmarq.ocx]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\htmlmm.ocx]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\install.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ishscan.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ISSTE.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\javai.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\jvm.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\jvm_g.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\main123w.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mngreg32.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\msci_uno.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mscoree.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mscorsvr.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mscorwks.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\msjava.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mso.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NAVOPTRF.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NeVideoFX.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NPMLIC.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NSWSTE.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\photohse.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PMSTE.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ppw32hlp.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\printhse.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\prwin8.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ps80.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\psdmt.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\qfinder.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\qpw.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\salwrap.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\setup.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\setup32.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\sevinst.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\symlcnet.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\tcore_ebook.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TFDTCTT8.DLL]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ua80.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\udtapi.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ums.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vb40032.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vbe6.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\wpwin8.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\xlmlEN.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\xwsetup.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Your Image File Name Here without a path]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\_INSTPGM.EXE]

¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection]

¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ Reference

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 338c86357871c167a96ab976519bf59e
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

¤¤¤¤¤¤¤¤¤¤ Explorer ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ Winlogon ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤

D'fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c7b379b-f5c3-11dd-8b13-00e04cf10d09}\shell\auto\command
@ = cmd /C launch.bat
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c7b379b-f5c3-11dd-8b13-00e04cf10d09}\shell\autorun
Extended =
@ = &Exécution automatique
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c7b379b-f5c3-11dd-8b13-00e04cf10d09}\shell\autorun\command
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c7b379b-f5c3-11dd-8b13-00e04cf10d09}\shell\autorun\command
@ = C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40ef42f0-8a90-11df-a250-00e04cf10d09}\shell\autorun
Extended =
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40ef42f0-8a90-11df-a250-00e04cf10d09}\shell\autorun\command
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40ef42f0-8a90-11df-a250-00e04cf10d09}\shell\autorun\command
@ = F:\InstallTomTomHOME.exe

¤¤¤¤¤¤¤¤¤¤ Rogues Infections ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

[@ = ]
[HKEY_CURRENT_USER\software\Ad-Remover]
[HKEY_CURRENT_USER\software\Adobe]
[HKEY_CURRENT_USER\software\Ahead]
[HKEY_CURRENT_USER\software\AIM]
[HKEY_CURRENT_USER\software\ALWIL Software]
[HKEY_CURRENT_USER\software\Anuman Interactive]
[HKEY_CURRENT_USER\software\AppDataLow]
[HKEY_CURRENT_USER\software\Apple Computer, Inc.]
[HKEY_CURRENT_USER\software\ArcSoft]
[HKEY_CURRENT_USER\software\Audacity]
[HKEY_CURRENT_USER\software\Avg]
[HKEY_CURRENT_USER\software\Azureus]
[HKEY_CURRENT_USER\software\Binary Noise]
[HKEY_CURRENT_USER\software\BitDefender]
[HKEY_CURRENT_USER\software\Broderbund Software]
[HKEY_CURRENT_USER\software\CamStudioOpenSource for Nick]
[HKEY_CURRENT_USER\software\Clients]
[HKEY_CURRENT_USER\software\Digital River]
[HKEY_CURRENT_USER\software\DivXNetworks]
[HKEY_CURRENT_USER\software\ej-technologies]
[HKEY_CURRENT_USER\software\ESTsoft]
[HKEY_CURRENT_USER\software\GameHouse]
[HKEY_CURRENT_USER\software\GNU]
[HKEY_CURRENT_USER\software\Google]
[HKEY_CURRENT_USER\software\Hewlett-Packard]
[HKEY_CURRENT_USER\software\HookNetwork]
[HKEY_CURRENT_USER\software\http://www.ecran-de-veille.com]
[HKEY_CURRENT_USER\software\IM Providers]
[HKEY_CURRENT_USER\software\InstallShield]
[HKEY_CURRENT_USER\software\Intel]
[HKEY_CURRENT_USER\software\InterVideo]
[HKEY_CURRENT_USER\software\IVIIS]
[HKEY_CURRENT_USER\software\JavaSoft]
[HKEY_CURRENT_USER\software\keyhole.com]
[HKEY_CURRENT_USER\software\Lake]
[HKEY_CURRENT_USER\software\Libnet]
[HKEY_CURRENT_USER\software\Local AppWizard-Generated Applications]
[HKEY_CURRENT_USER\software\Macromedia]
[HKEY_CURRENT_USER\software\Magnet]
[HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware]
[HKEY_CURRENT_USER\software\ManyCam 2.4]
[HKEY_CURRENT_USER\software\Microsoft]
[HKEY_CURRENT_USER\software\Mindscape]
[HKEY_CURRENT_USER\software\Mozilla]
[HKEY_CURRENT_USER\software\MozillaPlugins]
[HKEY_CURRENT_USER\software\Netscape]
[HKEY_CURRENT_USER\software\Nokia]
[HKEY_CURRENT_USER\software\Northcode Inc]
[HKEY_CURRENT_USER\software\NOS]
[HKEY_CURRENT_USER\software\ODBC]
[HKEY_CURRENT_USER\software\Patchou]
[HKEY_CURRENT_USER\software\Piriform]
[HKEY_CURRENT_USER\software\Policies]
[HKEY_CURRENT_USER\software\PrivacyEraser Computing, Inc.]
[HKEY_CURRENT_USER\software\RayV]
[HKEY_CURRENT_USER\software\RDE]
[HKEY_CURRENT_USER\software\RECISIO]
[HKEY_CURRENT_USER\software\RespectSoft]
[HKEY_CURRENT_USER\software\River Past]
[HKEY_CURRENT_USER\software\Royal Philips]
[HKEY_CURRENT_USER\software\Samsung]
[HKEY_CURRENT_USER\software\SecuROM]
[HKEY_CURRENT_USER\software\Sensaura]
[HKEY_CURRENT_USER\software\Skype]
[HKEY_CURRENT_USER\software\Softonic]
[HKEY_CURRENT_USER\software\SoftVTU]
[HKEY_CURRENT_USER\software\Stardock]
[HKEY_CURRENT_USER\software\TerraTec Electronic GmbH]
[HKEY_CURRENT_USER\software\Todae]
[HKEY_CURRENT_USER\software\TomTom]
[HKEY_CURRENT_USER\software\Trolltech]
[HKEY_CURRENT_USER\software\TVSSI]
[HKEY_CURRENT_USER\software\VB and VBA Program Settings]
[HKEY_CURRENT_USER\software\VirtualDub.org]
[HKEY_CURRENT_USER\software\VSO]
[HKEY_CURRENT_USER\software\Windows Sidebar]
[HKEY_CURRENT_USER\software\WinRAR SFX]
[HKEY_CURRENT_USER\software\Xobni]
[HKEY_CURRENT_USER\software\Yahoo]
[HKEY_CURRENT_USER\software\YahooPartnerToolbar]
[HKEY_CURRENT_USER\software\Classes]

[HKEY_LOCAL_MACHINE\software\8ec]
[HKEY_LOCAL_MACHINE\software\Adobe]
[HKEY_LOCAL_MACHINE\software\Ahead]
[HKEY_LOCAL_MACHINE\software\ALWIL Software]
[HKEY_LOCAL_MACHINE\software\AppDataLow]
[HKEY_LOCAL_MACHINE\software\Apple Computer, Inc.]
[HKEY_LOCAL_MACHINE\software\ArcSoft]
[HKEY_LOCAL_MACHINE\software\Arobas Music]
[HKEY_LOCAL_MACHINE\software\ATI Technologies]
[HKEY_LOCAL_MACHINE\software\AVG]
[HKEY_LOCAL_MACHINE\software\Azureus]
[HKEY_LOCAL_MACHINE\software\BlenderFoundation]
[HKEY_LOCAL_MACHINE\software\Boonty]
[HKEY_LOCAL_MACHINE\software\Broderbund Software]
[HKEY_LOCAL_MACHINE\software\C07ft5Y]
[HKEY_LOCAL_MACHINE\software\CCleaner]
[HKEY_LOCAL_MACHINE\software\CDDB]
[HKEY_LOCAL_MACHINE\software\Classes]
[HKEY_LOCAL_MACHINE\software\Clients]
[HKEY_LOCAL_MACHINE\software\Corel]
[HKEY_LOCAL_MACHINE\software\DivXNetworks]
[HKEY_LOCAL_MACHINE\software\ej-technologies]
[HKEY_LOCAL_MACHINE\software\Enjoy Station]
[HKEY_LOCAL_MACHINE\software\ESTsoft]
[HKEY_LOCAL_MACHINE\software\Fraps]
[HKEY_LOCAL_MACHINE\software\FullCircle]
[HKEY_LOCAL_MACHINE\software\GameHouse]
[HKEY_LOCAL_MACHINE\software\Gemplus]
[HKEY_LOCAL_MACHINE\software\Google]
[HKEY_LOCAL_MACHINE\software\Hewlett-Packard]
[HKEY_LOCAL_MACHINE\software\Intel]
[HKEY_LOCAL_MACHINE\software\InterVideo]
[HKEY_LOCAL_MACHINE\software\IVIIS]
[HKEY_LOCAL_MACHINE\software\JavaSoft]
[HKEY_LOCAL_MACHINE\software\JreMetrics]
[HKEY_LOCAL_MACHINE\software\Lake]
[HKEY_LOCAL_MACHINE\software\LimeWire]
[HKEY_LOCAL_MACHINE\software\Macromedia]
[HKEY_LOCAL_MACHINE\software\magnet]
[HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware]
[HKEY_LOCAL_MACHINE\software\ManyCam]
[HKEY_LOCAL_MACHINE\software\Microsoft]
[HKEY_LOCAL_MACHINE\software\Mindscape]
[HKEY_LOCAL_MACHINE\software\Mozilla]
[HKEY_LOCAL_MACHINE\software\mozilla.org]
[HKEY_LOCAL_MACHINE\software\MozillaPlugins]
[HKEY_LOCAL_MACHINE\software\Nokia]
[HKEY_LOCAL_MACHINE\software\NOS]
[HKEY_LOCAL_MACHINE\software\Nullsoft]
[HKEY_LOCAL_MACHINE\software\ODBC]
[HKEY_LOCAL_MACHINE\software\Patchou]
[HKEY_LOCAL_MACHINE\software\PC Connectivity Solution]
[HKEY_LOCAL_MACHINE\software\Philips]
[HKEY_LOCAL_MACHINE\software\PhotoFiltre]
[HKEY_LOCAL_MACHINE\software\Piriform]
[HKEY_LOCAL_MACHINE\software\Policies]
[HKEY_LOCAL_MACHINE\software\Program Groups]
[HKEY_LOCAL_MACHINE\software\Python]
[HKEY_LOCAL_MACHINE\software\RECISIO]
[HKEY_LOCAL_MACHINE\software\RegisteredApplications]
[HKEY_LOCAL_MACHINE\software\River Past]
[HKEY_LOCAL_MACHINE\software\Schlumberger]
[HKEY_LOCAL_MACHINE\software\Secure]
[HKEY_LOCAL_MACHINE\software\Skype]
[HKEY_LOCAL_MACHINE\software\TerraTec]
[HKEY_LOCAL_MACHINE\software\TerraTec Electronic GmbH]
[HKEY_LOCAL_MACHINE\software\Todae]
[HKEY_LOCAL_MACHINE\software\TomTom]
[HKEY_LOCAL_MACHINE\software\Trad-FR]
[HKEY_LOCAL_MACHINE\software\TrendMicro]
[HKEY_LOCAL_MACHINE\software\VideoLAN]
[HKEY_LOCAL_MACHINE\software\Visual Sciences]
[HKEY_LOCAL_MACHINE\software\VSO]
[HKEY_LOCAL_MACHINE\software\Windows]
[HKEY_LOCAL_MACHINE\software\Windows 3.1 Migration Status]
[HKEY_LOCAL_MACHINE\software\Yahoo]

¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤

Present !! : C:\windows\002564_.tmp
Present !! : C:\windows\SET3.tmp
Present !! : C:\windows\SET4.tmp
Present !! : C:\windows\SET8.tmp
Present !! : C:\windows\Fonts\GRGAREF.TTF
Present !! : C:\windows\System32\drivers\etc\hosts.msn
Present !! : C:\windows\System32\images
Present !! : C:\windows\System32\SET103.tmp
Present !! : C:\windows\System32\SET10C.tmp
Present !! : C:\windows\System32\SET10E.tmp
Present !! : C:\windows\System32\SET11A.tmp
Present !! : C:\windows\System32\SET2C8.tmp
Present !! : C:\Documents and Settings\Astrid\Application Data\.#
Present !! : C:\Documents and Settings\Astrid\Application data\inst.exe
Present !! : C:\Documents and Settings\Astrid\Application Data\pcouffin.inf
Present !! : C:\Documents and Settings\Astrid\Application Data\pcouffin.log
Present !! : C:\Documents and Settings\Astrid\Application Data\inst.exe

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktop
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BOONTY_GAMES
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES
Present !! : HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_BOONTY_GAMES
Present !! : HKLM\SYSTEM\ControlSet004\Enum\Root\LEGACY_BOONTY_GAMES
Present !! : HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys

FEATURE_BROWSER_EMULATION | svchost :
====================================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-26 17:49:15
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 (0x1)
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 17:50:01,78

B) :

Deleted : HKLM\SYSTEM\ControlSet004\Enum\Root\LEGACY_BOONTY_GAMES
Deleted : HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = http://www.google.com/
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 ()
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

FEATURE_BROWSER_EMULATION | svchost :
====================================

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Pour le C) : rien ne se passe, c'est normale??..

Rapport ZHPDiag :

http://www.cijoint.fr/cjlink.php?file=cj201009/cijXAzjFsG.txt

Alors?...

Désolé pour l'attente, merci de ta patience ! Rapport :

SmitFraudFix v2.424

Rapport fait à 16:47:15,35, 27/09/2010
Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\windows\Explorer.EXE
C:\windows\system32\spoolsv.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\windows\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\windows\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\windows\system32\ctfmon.exe
C:\Program Files\PrivacyEraser Computing\Free Internet Eraser\InternetEraser.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\windows\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\windows

»»»»»»»»»»»»»»»»»»»»»»»» C:\windows\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\windows\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\windows\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\windows\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Astrid

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Astrid\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Astrid\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Astrid\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\windows\\System32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E778C6B2-897F-4C95-9565-3B810BBB8128}: DhcpNameServer=85.255.112.132,85.255.112.188
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B557546E-35D3-4359-AB40-37D455DC52DF}: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonjour !
Bon ben écoutes, j'ai eu un sacré virus,
qui me coupais ma connexion internet, & mes antivirus ect..
Pas d'ordi pendant une semaine & dépanage que ce soir.
En gros, j'ai du faire appel a un amis informaticien, qui ma bien vider mon ordi, & donc je penses que je suis tranquille pour un moment haha.
Merci beaucoup pour ton aide & désolé de ne pas t'avoir dis de nouvel ect..
A bientôt !
( ordinateur plus rapide ! )

Bonjour,

Bonjour, mon ordinateur est lent.

Oui ,ok mais est ce nouveau ou pas ?

A+